/* Rent vs. Buy — MSAL auth gate + fail-closed visibility (styles/auth.css)
   Layer 7 of the theme contract (loads last so the gate always wins).

   The body ships data-auth-state="checking" in static HTML; every protected
   region stays hidden in any state except signed-in. scripts/auth.js advances
   body[data-auth-state]. There is no bypass. Tokens come from hfg-base.css. */
body:not([data-auth-state="signed-in"]) .site-nav,
body:not([data-auth-state="signed-in"]) #mv,
body:not([data-auth-state="signed-in"]) #pg1,
body:not([data-auth-state="signed-in"]) #pg2{display:none!important;}
body[data-auth-state="signed-in"] .auth-gate{display:none;}

.auth-gate{position:fixed;inset:0;z-index:1000;display:flex;flex-direction:column;align-items:center;justify-content:center;gap:14px;background:var(--hfg-blue-deep);text-align:center;padding:24px;}
.auth-title{font-family:var(--sans);font-size:26px;font-weight:800;color:#fff;letter-spacing:-.01em;}
.auth-msg{font-size:13px;color:rgba(255,255,255,.55);max-width:380px;line-height:1.55;}
.auth-btn{margin-top:8px;padding:10px 22px;border-radius:8px;background:var(--hfg-teal);border:none;color:#fff;font-family:var(--sans);font-size:14px;font-weight:600;cursor:pointer;}
.auth-btn:hover{background:var(--hfg-teal-dark);}

/* Graph /me headshot inside the report LO avatar and the mobile share-sheet
   avatar (scripts/profile.js); when no photo is available the .av keeps its
   initials text. */
.rp .lo .av img,#mv .sheet .lo .av img{width:100%;height:100%;border-radius:50%;object-fit:cover;}

/* Graph autofill status inside the combined LO notice — emphasized so the
   "review before printing" ask stands out from the static requirement text.
   (No display override: the [hidden] attribute must keep hiding it.) */
#lo-autofill-note{color:var(--hfg-teal-dark);font-weight:700;}